PROVIDER ADMINISTRATOR OPENS 
SERVICE AGREEMENT INTERFACE ON PAR 
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APPLICATIONS AND ASSOCIATED SERVERS 
MAPPED TO SUBSCRIBERS THROUGH 
CONTRACTS 
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PAR SIGNS CONTRACT WITH PROVIDER'S 
PUBLIC KEY AND PENDING AGREEMENT 
CIRCULATED TO OTHER PARs 
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PAR TRANSMITS ALL UNAPPROVED 
CONTRACTS TO SAR FOR APPROVAL 
ALONG WITH HASH OF ALL APPROVED 
CONTRACTS 



v/v 
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SAR SIGNS NEW CONTRACTS AND 
RETURNS TO PAR 
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SAR DOWNLOADS FULL LIST OF 
CONTRACTS FROM PAR 
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APPROVED 
CONTRACTS NOT 
FULFILLED? 



SAR INITIATES TUNNEL ALLOCATION 
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FIG. 3A 




APPROVED CONTRACT RECEIVED 
FROM SUBSCRIBER AND VERIFIES ^320 
NON-REPUDIATION AND 
AUTHENTICITY 



APPROVED AGREEMENT 
CIRCULATED TO PARs 
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PARs ATTEMPT TCP CONNECTIONS 
TO SERVER(S) 
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PAR SUCCESSFUL 
IN CONNECTING? 



SUCCESSFUL PARS REGISTER K/v 
THEIR ABILITY TO FULFILL THE 
CONTRACT INCLUDING LOAD 
WEIGHTING 
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FIG. 3B 
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SAR REGISTERS IP ADDRESS AND 
PUBLIC KEY OF SAR WITH PROVIDER 
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SAR CONTACTS PROVIDER 
BRIDGEHEAD FOR A LIST OF PARS 
THAT CAN SUPPORT A GIVEN 
APPROVED CONTRACT 
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BRIDGEHEAD SENDS A LIST OF ALL 
PARS THAT CAN CONNECT TO THE 
SERVER(S) SPECIFIED IN THE 
CONTRACT 
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SAR TIMES EACH OF THE LISTED 
PAR(S) TO DETERMINE EACH PAR'S 
ABILITY TO SERVICE THE GIVEN 
CONTRACT 
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SAR SELECTS PAR AND 
NEGOTIATES TUNNEL 
CONFIGURATION INFO 
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FIG. 5 



USER CONTACTS SUBSCRIBER 
APPLICATION ROUTER (SAR) 
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"SAR DETERMINES IF 
THE USER SHOULD BE 
AUTHENTICATED BY THE 
SUBSCRIBER 



SAR AUTHENTICATES USER 
VIA APPROPRIATE AUTH. 
AUTHORITY 
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SAR GATHERS GROUP ASSOCIATIONS FOR THE 
USER AND AUTHORIZES THE USER FOR ANY 
APPLICATIONS ALLOCATED TO THAT USER 



THE SAR DIS 
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USER SELECTS ONE OF THE 
ACCESSIBLE APPLICATIONS 
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'PAR DETERMINES IF^ 
THE USER SHOULD BE 
AUTHENTICATED BY THE 
PROVIDER 
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PAR AUTHENTICATES USER 
VIA APPROPRIATE AUTH. 
AUTHORITY 



PAR GATHERS GROUP ASSOCIATIONS FOR 
THE USER AND AUTHORIZES THE USER FOR 
ANY APPLICATIONS ALLOCATED TO THAT 
USER 



SAR AND PAR FACILITATE 
ACCESS BY THE CLIENT TO 
THE SELECTED 
APPLICATION SERVER 
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